Intelligent quarantine on switch fabric for physical and virtualized infrastructure
Systems, methods, and computer-readable media for performing threat remediation through a switch fabric of a virtualized network environment. Data traffic passing into a virtualized network environment including a plurality of virtual machines running on a switch fabric is monitored. A network threat introduced through at a least a portion of the data traffic is identified at the switch fabric. One or more remedial measures are performed in the network environment based on the identification of the network threat in the virtualized network environment.
1. A method comprising:
monitoring, at one or more network nodes of a virtualized network environment, data traffic passing into the virtualized network environment, wherein the virtualized network environment includes a plurality of workloads hosted in the virtualized network environment;
identifying, using a first network node of the one or more network nodes of the virtualized network environment, a Denial of Service (DOS) (DDeS) attack introduced into the virtualized network environment through at least a portion of the data traffic passing into the virtualized network environment, the first network node receiving the at least a portion of the data traffic introducing a network threat; and
performing one or more remedial measures in the virtualized network environment based on the identification of the DoS attack in the virtualized network environment, at least one of the one or more remedial measures comprising:
generating DoS threat information including a signature of the data traffic associated with the network traffic; and
distributing the DoS threat information to at least a second network node of the one or more network nodes of the virtualized network environment.
2. The method of claim 1 , further comprising:
intercepting the at least a portion of the data traffic introducing the DoS attack into the virtualized network environment; and
performing the one or more remedial measures while the at least a portion of the data traffic remains in the virtualized network environment.
3. The method of claim 1 , wherein the one or more remedial measures further includes quarantining, in the virtualized network environment, the at least a portion of the data traffic introducing the DoS in the virtualized network environment.
4. The method of claim 1 , wherein the one or more remedial measures comprises preventing transmission of the at least a portion of the data traffic introducing the DoS attack to the workloads in the virtualized network environment.
5. The method of claim 4 , wherein the workloads are virtual machines; the remedial measures further comprising preventing transmission of the at least a portion of the data traffic introducing the DoS attack to one or more hypervisors hosting the workloads in the virtualized network environment.
6. The method of claim 1 , wherein the DoS threat information includes one or a combination of an identification of a source of the at least a portion of the data traffic introducing the DoS attack into the virtualized network environment, a signature of the at least a portion of the data traffic, and an identification of characteristics of the at least a portion of the data traffic.
7. The method of claim 1 , further comprising:
matching the at least a portion of the data traffic introducing the DoS attack to a known network threat based on a signature of the at least a portion of the data traffic and a signature of the known network threat; and
identifying the network threat in the at least a portion of the data traffic based on a matching of the at least a portion of the data traffic to the known network threat.
8. A system comprising:
one or more processors; and
at least one non-transitory computer-readable storage medium having stored therein instructions which, when executed by the one or more processors, cause the one or more processors to perform operations comprising:
monitoring, at one or more network nodes of a virtualized network environment, data traffic passing into the virtualized network environment,
wherein the virtualized network environment includes including a plurality of workloads hosted in the virtualized network environment;
identifying, using a first network node of the one or more network nodes of the virtualized network environment, a Denial of Service (DoS) attack introduced into the virtualized network environment through at least a portion of the data traffic passing into the virtualized network environment, the first network node receiving the at least a portion of the data traffic introducing a network threat; and
performing one or more remedial measures in the virtualized network environment based on the identification of the DoS attack in the virtualized network environment, at least one of the one or more remedial measures comprising:
generating DoS threat information including a signature of the data traffic associated with the network traffic; and
distributing the DoS threat information to at least a second network node of the one or more network nodes of the virtualized network environment.
9. The system of claim 8 , the operations further comprising:
intercepting the at least a portion of the data traffic introducing the DoS attack into the virtualized network environment; and
performing the one or more remedial measures while the at least a portion of the data traffic remains in the virtualized network environment.
10. The system of claim 8 , wherein the one or more remedial measures further includes quarantining, in the virtualized network environment, the at least a portion of the data traffic introducing the DoS in the virtualized network environment.
11. The system of claim 8 , wherein the one or more remedial measures comprises preventing transmission of the at least a portion of the data traffic introducing the DoS attack to the workloads in the virtualized network environment.
12. The system of claim 11 , wherein the workloads are virtual machines; the remedial measures further comprising preventing transmission of the at least a portion of the data traffic introducing the DoS attack to one or more hypervisors hosting the workloads in the virtualized network environment.
13. The system of claim 8 , wherein the DoS threat information includes one or a combination of an identification of a source of the at least a portion of the data traffic introducing the DoS attack into the virtualized network environment, a signature of the at least a portion of the data traffic, and an identification of characteristics of the at least a portion of the data traffic.
14. The system of claim 8 , the operations further comprising:
matching the at least a portion of the data traffic introducing the DoS attack to a known network threat based on a signature of the at least a portion of the data traffic and a signature of the known network threat; and
identifying the network threat in the at least a portion of the data traffic based on a matching of the at least a portion of the data traffic to the known network threat.
15. A non-transitory computer-readable storage medium having stored therein instructions which, when executed by a processor, cause the processor to perform operations comprising:
monitoring, at one or more network nodes of a virtualized network environment, data traffic passing into the virtualized network environment, wherein the virtualized network environment includes a plurality of workloads hosted in the virtualized network environment;
identifying, using a first network node of the one or more network nodes of the virtualized network environment, a Denial of Service (Dos) attack introduced into the virtualized network environment through at least a portion of the data traffic passing into the virtualized network environment, the first network node receiving the at least a portion of the data traffic introducing a network threat; and
performing one or more remedial measures in the virtualized network environment based on the identification of the DoS attack in the virtualized network environment, at least one of the one or more remedial measures comprising:
generating DoS threat information including a signature of the data traffic associated with the network traffic; and
distributing the DoS threat information to at least a second network node of the one or more network nodes of the virtualized network environment.
16. The non-transitory computer-readable storage medium of claim 15 , the operations further comprising:
intercepting the at least a portion of the data traffic introducing the DoS attack into the virtualized network environment; and
performing the one or more remedial measures while the at least a portion of the data traffic remains in the virtualized network environment.
17. The non-transitory computer-readable storage medium of claim 15 , wherein the one or more remedial measures further includes quarantining, in the virtualized network environment, the at least a portion of the data traffic introducing the DoS in the virtualized network environment.
18. The non-transitory computer-readable storage medium of claim 15 , wherein the one or more remedial measures comprises preventing transmission of the at least a portion of the data traffic introducing the DoS attack to the workloads in the virtualized network environment.
19. The non-transitory computer-readable storage medium of claim 18 , wherein the workloads are virtual machines; the remedial measures further comprising preventing transmission of the at least a portion of the data traffic introducing the DoS attack to one or more hypervisors hosting the workloads in the virtualized network environment.
20. The non-transitory computer-readable storage medium of claim 15 , wherein the DoS threat information includes one or a combination of an identification of a source of the at least a portion of the data traffic introducing the DoS attack into the virtualized network environment, a signature of the at least a portion of the data traffic, and an identification of characteristics of the at least a portion of the data traffic.
21. The non-transitory computer-readable storage medium of claim 15 , the operations further comprising:
matching the at least a portion of the data traffic introducing the DoS attack to a known network threat based on a signature of the at least a portion of the data traffic and a signature of the known network threat; and
identifying the network threat in the at least a portion of the data traffic based on a matching of the at least a portion of the data traffic to the known network threat.